Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2021-3667

Improper Locking

Published: Mar 02, 2022 | Modified: Feb 10, 2025
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
3.5 LOW
AV:N/AC:M/Au:S/C:N/I:N/A:P
RedHat/V2
RedHat/V3
6.5 LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Ubuntu
LOW
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2021-3667
CWEhttps://cwe.mitre.org/data/definitions/667.html

An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly released on ACL permission failure. Clients connecting to the read-write socket with limited ACL permissions could use this flaw to acquire the lock and prevent other users from accessing storage pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

Weakness

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Affected Software

NameVendorStart VersionEnd Version
LibvirtRedhat4.1.0 (including)7.5.0 (including)
Advanced Virtualization for RHEL 8.2.1RedHatvirt:8.2-8020120210917153657.863bb0db*
Advanced Virtualization for RHEL 8.2.1RedHatvirt-devel:8.2-8020120210917153657.863bb0db*
Advanced Virtualization for RHEL 8.4.0.ZRedHatvirt:av-8040020210922084349.522a0ee4*
Advanced Virtualization for RHEL 8.4.0.ZRedHatvirt-devel:av-8040020210922084349.522a0ee4*
Red Hat Enterprise Linux 8RedHatvirt-devel:rhel-8050020211001230723.b4937e53*
Red Hat Enterprise Linux 8RedHatvirt:rhel-8050020211001230723.b4937e53*
LibvirtUbuntudevel*
LibvirtUbuntuesm-infra/focal*
LibvirtUbuntufocal*
LibvirtUbuntuhirsute*
LibvirtUbuntujammy*
LibvirtUbuntutrusty*
LibvirtUbuntuupstream*
LibvirtUbuntuxenial*

Extended Description

Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use